The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:0898 advisory.

    Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the     challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a     model-view-controller (MVC) framework for web application development. Action Pack implements the     controller and the view components.

    Security Fix(es):

    * A number of unused delete routes are present in CloudForms which can be accessed via GET requests     instead of just POST requests. This could allow an attacker to bypass the protect_from_forgery XSRF     protection causing the routes to be used. This attack would require additional cross-site scripting or     similar attacks in order to execute. (CVE-2017-2653)

    Additional Changes:

    This update also fixes several bugs and adds various enhancements. Documentation for these changes is     available from the Technical Notes document linked to in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Plugins Search

medium